Recently, Sandvine, an Internet service provider in over 85 countries, has published a Spring 2011 Global Internet Phenomena Report on new Internet trends which show a steady increase in the usage of on-demand applications. In North America, Netflix has become the single largest source of Internet traffic overall. These streaming applications can become a real burden when they start affecting business critical applications; this begs the question, “how can you use NetFlow to identify Netflix traffic?”
How to monitor Netflix traffic
Since Netflix uses a common web port (80) for data transfers, it can be difficult to identify Netflix from other web applications with NetFlow v5. The good news is that this task is easily accomplished with IPFIX NetFlow URL exports from vendors such as nProbe, SonicWALL, Flow Auditor and Citrix AppFlow.
Let’s look at an example Netflix nProbe URL report. We took a break from our day-to-day activities to stream Whale Wars on Netflix. Since our Internet traffic goes through an nProbe, which is exporting URLs, all we had to do was run a nProbe Top URLs report and then add an Advanced Filter for HTTP_URL then tell it to look for Netflix.
You can see that in under 20 minutes we had already streamed over 2Gb of Netflix traffic.
How to alert on Netflix traffic
Now the question is, “how can we be alerted if someone is streaming Netflix?” Our NetFlow and IPFIX analyzer has the ability to trigger alarms on any report that you generate. So all we need to do is create an inbound traffic threshold for the nProbe Netflix URL report above. Now you’ll start getting Netflix IPFIX alarms when someone starts streaming a Netflix video.
This is one of the many ways to use our NetFlow and IPFIX analyzer to answer the age old question “Why is the network slow?”